Unknown Paymob For Woocommerce vulnerabilities

4 CVEs affecting Unknown Paymob For Woocommerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-87978, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-15205, published 2026-08-14. High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days. The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback,…
CVE-2026-87979, published 2026-09-23. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a…
CVE-2026-87981, published 2026-09-23. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with…
CVE-2026-87978, published 2026-09-23. Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days. The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce…